CVE-2026-18330 (GCVE-0-2026-18330)
Vulnerability from cvelistv5
Published
2026-09-03 22:24
Modified
2026-10-27 17:39
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-321 - Use of hard-coded cryptographic key
Summary
A hard-coded
cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.
The same RSA-1024 private key is stored within firmware configuration files and
reused across devices. An attacker who obtains the private key and captures an
HTTP Web UI login session may use the key to decrypt the administrator
password.
Successful
exploitation may disclose the administrator password captured from an HTTP
login session and compromise session confidentiality.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | RE305 v3 |
Version: 0 < 1.1.8 Build 20260921 Rel. 42853 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:39:51.418332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:25:58.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RE305 v3",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.8 Build 20260921 Rel. 42853",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Archer C7 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.1 Build 20260821 Rel. 41256",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Victor Mota"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA hard-coded\ncryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.\nThe same RSA-1024 private key is stored within firmware configuration files and\nreused across devices. An attacker who obtains the private key and captures an\nHTTP Web UI login session may use the key to decrypt the administrator\npassword.\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "A hard-coded\ncryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.\nThe same RSA-1024 private key is stored within firmware configuration files and\nreused across devices. An attacker who obtains the private key and captures an\nHTTP Web UI login session may use the key to decrypt the administrator\npassword.\u00a0\n\n\n\n\n\nSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:39:53.630Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/re305/v3/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/re305/v3/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5362/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-18330",
"datePublished": "2026-09-03T22:24:45.430Z",
"dateReserved": "2026-07-29T20:03:53.524Z",
"dateUpdated": "2026-10-27T17:39:53.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18330\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-04T17:39:51.418332Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-04T17:39:53.006Z\"}}], \"cna\": {\"title\": \"Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Victor Mota\"}], \"impacts\": [{\"capecId\": \"CAPEC-37\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-37 Retrieve Embedded Sensitive Data\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"RE305 v3\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.1.8 Build 20260921 Rel. 42853\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"Archer C7 v5\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.3.1 Build 20260821 Rel. 41256\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.tp-link.com/us/support/download/re305/v3/#Firmware\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/re305/v3/#Firmware\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/us/support/faq/5362/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A hard-coded\\ncryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.\\nThe same RSA-1024 private key is stored within firmware configuration files and\\nreused across devices. An attacker who obtains the private key and captures an\\nHTTP Web UI login session may use the key to decrypt the administrator\\npassword.\\u00a0\\n\\n\\n\\n\\n\\nSuccessful\\nexploitation may disclose the administrator password captured from an HTTP\\nlogin session and compromise session confidentiality.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA hard-coded\\ncryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.\\nThe same RSA-1024 private key is stored within firmware configuration files and\\nreused across devices. An attacker who obtains the private key and captures an\\nHTTP Web UI login session may use the key to decrypt the administrator\\npassword.\u0026nbsp;\u003c/p\u003e\\n\\n\u003cp\u003eSuccessful\\nexploitation may disclose the administrator password captured from an HTTP\\nlogin session and compromise session confidentiality.\u0026nbsp;\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-321\", \"description\": \"CWE-321 Use of hard-coded cryptographic key\"}]}], \"providerMetadata\": {\"orgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"shortName\": \"TPLink\", \"dateUpdated\": \"2026-10-27T17:39:53.630Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-18330\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-27T17:39:53.630Z\", \"dateReserved\": \"2026-07-29T20:03:53.524Z\", \"assignerOrgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"datePublished\": \"2026-09-03T22:24:45.430Z\", \"assignerShortName\": \"TPLink\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…